[Task] Add null/length guards across k8s ingress parsers and reconcilers

Background

A 2026-08-02 source audit confirmed that 7 open issues share the same root cause: k8s ingress parsers and reconcilers in shenyu-kubernetes-controller dereference informer lookups, annotations, labels, and per-address arrays without null/length guards, producing NPEs / ArrayIndexOutOfBoundsExceptions during transient cache misses or partial/missing annotations.

Affected issues (all verified VALID)

• #6484 Dubbo ingress parsing throws NPE when endpoints are missing (DubboIngressParser.java:337-338, 161-162 — v1Endpoints.getSubsets() with no null check on v1Endpoints; contrast DivideIngressParser which guards)
• #6490 gRPC ingress parsing throws NPE when endpoints are missing (GrpcParser.java:156, 187 — same gap)
• #6486 Kubernetes RPC ingress parsers can throw NPE when labels or services are missing (DubboIngressParser.java:241-242, GrpcParser.java:255-256, SofaParser.java:172-173 — labels.keySet() and serviceLister...get(...).getMetadata() unguarded)
• #6491 Ingress reconciler dereferences missing ingress or annotations before validation (IngressReconciler.java:134-138 — annotation access before the isNull(v1Ingress) check; enablePluginsBasedOnAnnotations NPEs on null annotations)
• #6485 Kubernetes upstream protocol annotation can break Divide and Dubbo ingress parsing (DivideIngressParser.java:325 array index OOB; DubboIngressParser.java:339 NPE on absent annotation; :356 double-increment of i)
• #6492 Kubernetes gRPC/Sofa context-path parsing reads annotations from the wrong resource (IngressParser.java:109 -> ContextPathParser.java:87 reads ingress annotations while the examples place the annotation on the Service; injected serviceLister is dead)
• #6493 Endpoint updates can rewrite multi-port service routes to the wrong port (EndpointsReconciler.java:192-195 picks first TCP port; ServiceIngressCache never records the selected backend port)

Suggested fix pattern

1. Standardize the lister-lookup guard: every endpointsLister.namespace(ns).get(name) / serviceLister...get(...) must null-check before .getSubsets()/.getMetadata() — mirror the existing guard in IngressReconciler.java:578-582 and DivideIngressParser.
2. Validate annotations/labels before use: null-check getAnnotations()/getLabels(); skip-and-defer (let a later reconcile retry) when the referenced Service is not yet in cache.
3. Bounds-check per-address arrays (the protocol[i++] pattern) and fix the double-increment in DubboIngressParser.java:356.
4. Persist the selected backend port through ServiceIngressCache so EndpointsReconciler rewrites preserve the ingress-selected port.
5. Add unit tests with missing endpoints/annotations/labels as fixtures (the current controller tests cover only the happy path — see the governance audit).

Goal

Track the shared hardening pass so the 7 issues close under one focused PR rather than seven scattered patches.

Audit ref: docs/issue-candidates-2026-08-02.md